PRIVACY POLICY

Darla Paola Maldonado Barsse, NNCP
Nutritionist | Natural Nutrition Clinical Practitioner (CANNP Member)
507-8 Wilsonview Ave, Guelph, Ontario N1G 1V3, Canada
info@darlabarsse.com | https://darlabarsse.com
Effective October 22, 2026 | Version 1.0

1. About this policy and who is responsible

Darla Paola Maldonado Barsse ("Darla", "I", "my practice") provides online nutrition counselling to clients in Canada. I am responsible for the personal information under my custody or control. Contact me at info@darlabarsse.com for privacy questions, requests, concerns or complaints. Depending on the information and activities involved, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario's Personal Health Information Protection Act (PHIPA), and other applicable provincial laws may govern. This policy describes my practices without suggesting that membership in CANNP is a provincial healthcare licence.

2. Information collected

I may collect contact and identity details (including legal name, email, telephone, mailing address and, when appropriate, a parent/guardian or substitute decision-maker's details); booking and payment-related records; nutrition intake forms, allergies, medications and supplements, relevant medical history voluntarily disclosed, eating patterns and goals; body measurements and progress notes; dietary plans, food logs, messages, uploaded documents and consultation records; consent records; and technical information needed to operate and secure the website (such as access logs and session information). I seek only information reasonably needed for an identified purpose.

3. Why the information is used

I use information to determine whether services are appropriate, provide individualized nutrition counselling, document consultations, prepare and deliver meal plans, operate patient accounts and video appointments, respond to service inquiries, manage scheduling and payment, issue accurate receipts, maintain clinical and financial records, safeguard the service and satisfy applicable legal duties. Sensitive health information is not used for advertising or promotional mailing lists. I do not submit patient information to external generative-AI tools as part of my current practice.

4. Consent and choices

I request meaningful consent appropriate to the sensitivity and purpose of information, including express consent for the nutrition services at booking. Clients may ask questions before providing information and may withdraw consent to future optional uses or future services, subject to lawful record-retention and other obligations. When a minor is involved, consent and access arrangements are assessed according to capacity and applicable law; a parent's involvement is not an automatic substitute for the consent of a capable minor. Where information necessary to provide a safe service is withheld, I may be unable to proceed with the consultation.

5. Service providers and access

The practice uses its website and private patient portal to manage appointments, files, forms, records and online consultations. Payments are processed through Stripe; I do not need to receive a complete payment-card number to confirm the payment. I may use website hosting, email, messaging, backup and video-communication infrastructure to operate these services. These providers may process information only as needed for their respective services and subject to appropriate contractual or technical safeguards. Actual hosting and subprocessors, including their processing locations, are determined by the deployed services and may include locations outside the client's province or Canada; information in another jurisdiction may be subject to lawful access there. I do not guarantee exclusively Canadian data storage. The only practitioner with routine access to clinical files is Darla; essential technical service providers may have limited infrastructure access needed to maintain the service. Patients should be able to access only their own accounts and files.

6. Email, WhatsApp and video consultations

Clients may contact me by email or WhatsApp. Standard email and consumer messaging can carry privacy risks and may not be appropriate for detailed sensitive medical information. For especially sensitive records, use the secure patient portal where available. Video consultations occur through the website's consultation function; consultations are not recorded by the practice. A video or messaging provider may process necessary technical connection information. I will not record a consultation without obtaining a separate, explicit authorization and changing this notice when appropriate.

7. Payment and insurance receipts

Stripe processes online payments under its own privacy terms and technical controls. I keep transaction identifiers, fee amounts, appointment associations, payment status and receipt records as reasonably necessary. On request, a receipt suitable for submission to a benefits insurer may include the client's identifying and service details. A client normally submits the receipt directly to their insurer. No insurance coverage or reimbursement is guaranteed.

8. Security and incidents

I use administrative and technical safeguards appropriate to sensitive health information, including access restrictions for patient records, account authentication and backup procedures. No internet service is risk-free. If a security or privacy incident occurs, I will take reasonable containment and assessment steps and provide notifications when required under applicable law. Clients should safeguard passwords and promptly report suspected unauthorized access.

9. Retention and deletion

Clinical consultation records are generally retained for at least ten years following the last service, and longer where required for minors, applicable provincial obligations, complaints, proceedings or other legal holds. Ten years is the practice's baseline, not a promise to delete at an earlier date when the law requires longer retention. Financial, tax, payment and consent records may have separate applicable retention periods. After retention periods end and no further lawful reason requires the information, records are securely deleted or disposed of according to available technical procedures, including backup lifecycle constraints.

10. Access, correction and questions

Clients may request access to their personal information, an explanation of how it has been used or disclosed where applicable, and correction of inaccurate information. Rights and possible exceptions depend on applicable privacy law. I will verify identity before releasing sensitive records and explain any lawful limitation. Requests can be sent to info@darlabarsse.com. Clients may also raise concerns with the appropriate provincial or federal privacy regulator.

11. Website changes and policy updates

I may update this policy to reflect changes in services, law or technology. The current version and effective date will be displayed before a new client accepts it. A later version does not retroactively replace the version associated with a previous booking. Material changes affecting consent will be brought to clients' attention and any further required consent obtained.